Annotate both the per-platform manifests and the multi-arch image index (#1088)

Fixes #1087

.github/workflows/build-and-publish-docker-image.yml

@@ -79,6 +79,12 @@ jobs:
       - name: Extract metadata for ${{ matrix.target }} image
         id: meta
         uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        env:
+          # Annotate both the per-platform manifests and the multi-arch image
+          # index. The index level is what manifest-list consumers (Renovate's
+          # minimumReleaseAge soak check, provenance/SBOM tooling) read for the
+          # standard org.opencontainers.image.* annotations, including `created`.
+          DOCKER_METADATA_ANNOTATIONS_LEVELS: index,manifest
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}${{ matrix.image_name_suffix }}
           tags: |
@@ -105,6 +111,7 @@ jobs:
             RELEASE_VERSION=${{ github.ref_name }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          annotations: ${{ steps.meta.outputs.annotations }}
 
       - name: Generate artifact attestation for ${{ matrix.target }} image
         if: github.event_name != 'pull_request'